CLAIMS 

What js claimed is: 

1 . system for tracking network session information, the system 

comprising: 

an information source module having a source information input and a 
standardize information output, a source information corresponds to 
network usage information, a standardized information corresponds to the 
network usage information transformed into a standard format; 
a first program having Vt least a first standardized information input and an 
enhanced data output,V first-standardized information input corresponding 
to the standardized informaUdn, an enhanced data corresponding to the 
standardized data after sftd^SsT a?partial transformation, the at least partial 
transfonnation being de|H^ed atcording to a data record format; 
a second program having at least a first enhanced data input and a data record 
output, the first enhanced data conresponding to the enhanced data, a data 
record corresponding to the first enhanced data, the data record being 
formatted according to the data record fopnat; 
a database storing the data record; and 

wherein the second program merges duplicate da\a records that represent the 
same network usage information. 

2. The system of claim 1 wherein the at least parti^ transformation is 
defined fi'om a data enhancement procedure, and wherein the datarecord format 
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includes a. plurality of fields and wherein the data enhancement procedure defines how 
the standardized Ppformation is to be transformed into the pluraHty of fields of the data 
record format. 

3. The system of claim 2 wherein the data enhancement procedure 
includes at least a fieldVnhancement wherein the field enhancement defines a source 
for a predetermined fieldVn the plurality of fields. 

4. The systemof claim 2 wherein the data enhancement procedure 
includes at least a field enhartcement wherein Ihe field enhancement defines a function 
to be applied to at least a portidn of the standardized data. 

5. The system qfClaiWz wherein the data enhancement procedure defines 
a plurality of field enhancementi^Herein each field enhancement defines network 
usage information to be stored in the Plurality of fields. 

6. The system of claim 2 fiitther comprising a second information source 
module, the second information source module having a second source information 
input and a second standardized information output, a second source information 
corresponds to a second network informafionXa second standardized information 
corresponds to the second network informationVransformed into a standard format, 
and wherein the data enhancement procedure incmdes a first definition of at least a 
first field in the plurality of fields being fi-om the standardized information, and at 
least a second definition of a second field in the plurality of fields being firom the 
second standardized information. 

7. The system of 6 fiarther comprising a pro?^ server and a domain name 
system (DNS) server, and wherein the information source module receives the 
network usage information from the proxy server, and where\n the second information 
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source module receives the second network information from the DNS server, and 
wherein tire first definition defines that a source IP address supplied by the proxy • 
server shouloSbe put into the first field, and wherein the second definition defines a 
URL supplied bV the DNS server should be put into the second field. 

8. TheNsystem of claim 1 wherein the second program manages the first 
program and the information source module. 

9. The system of claim 1 wherein the second program causes the data 
record to be stored in the database. 

10. The system of\:laim 1 wherein the information source module is 
configured to receive the network usage information fi-om a predetermined network 
device. \ \A. n 

11. The system of claim iVwHerein the at least partial transformation 
includes policy-based data ags:&gation v/hich defines how network usage data should 
be aggregated. \ 

12. The system of claim 1 wherem the network usage information includes 
IP session data. \ 

13. The system of claim 1 wherein theVlata format includes a plurality of 
fields including a source DP field, a destination IP fii^ld, a source host field, a 
destination host field, a service type field, a date and t\me field, a duration field, a 
total number of bytes field, and a counter field. \ 

14. The system of claim 1 further comprising aicustomer care and billing 
system coupled to the database, the customer care and billingNsystem for accessing the 
database to generate a bill firom the data record. \ 

15. A network usage accounting system comprising: \ 
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aa imormation source module coupled to receive network information from a 
network device; 

a gathered coupled to receive the network information source module, the 
gathered for performing data enhancements on the network information to 
create a pWality of data records; 
a central database storing the plurality of data records; and 
a central event mahager coupled to receive the plurality of data records, the 
central event manager merging duplicate records in the plurality of data 
records, the duplicke recgrds representing the same network usage 
information. 



16. The system oFcl'^j^^ 
configured to receive networld informVkin from a network device chosen from the 
group of network devices conskfmg of \ proxy server, a domain name service server, 
a firewall, a RADIUS server, and a router> 
15 17. The system of claim 1 5 wherein the gatherer performs filtering and 

aggregation on the network infomiation. 

18. The system of claim 15 wherein tW plurality of data records have a 
predefined data format comprising a plurality of fields, and wherein the data 
enhancements includes at least a first data field enhaJ^cement to enhance the network 

20 infomation to fill in the first data field. 

19. The system of claim 18 wherein the first oata field corresponds to a 
source IP address field and wherein the data enhancement mcludes extracting a source 
IP address value from the network information. 
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20/ - \The system of claim 18 wherein the first data field corresponds to a 
URL name field and wherein the data enhancement includes requesting a URL name 
from a domain nwic service server. 

21. A mkhod of gathering and aggregating network usage information 
from a set of network nevices, the system using at least a first program and a second 
program coupled in cornmunications, the method comprising: 

accessing networlocommunications usage information; 
filtering and aggreg^ing the network communications usage information 
using the first p/og^ 

completing a pluralit^^W fi"om the filtered and aggregated network 

communications ukagA in^crmiafion, the plurality of data records 
corresponding toi^tworV usage by a plurality of users; 

storing the plurality of data records; and 

merging duplicate records in the Vurality of data records. 

22. The method of claim 21 wherein completing the plurality of records 
includes accessing user account information. \ 

23. The method of claim 21 whereinVompleting the plurality of records 
includes for each data record determining a corresponding source IP address, a 
corresponding URL, a corresponding type of service \ised, and a corresponding 
amount of time used. \ 

24. The method of claim 21 wherein the syste A includes a third program 
coupled in communications with at least the second program\and wherein completing 
the plurality of records includes accessing the third program toaetermine network 
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accoiHit information and including the ne^vork account information in at least a first 
record in iHe plurality of records. 

25. xThe method of claim 2 1 wherein merging the dupUcate records 
includes comparink a plurality of fields in the data records to identify data records 

5 corresponding to the sime network session and merging the corresponding records. 

26. The method of claim 21 wherein merging the duplicate records 
includes automatically deleting a duplicate record. 

27. The method of cla^HrTl fiirther/omprising using the second program 
to automatically update the filtering^md a^egation performed by the first program. 

10 28. A network usagd trag^Ja^ystem oomprising: 

means for accessing network conirnjinications usage information; 
means for filtering and aggregating theynetwork communications usage 

information using the first program; \ 
means for completing a plurality of data records from the filtered and 
1 5 aggregated network communications usage\nformation, the plurality of 

data records corresponding to network usage By a plurality of users; 
means for storing the plurality of data records; and \ 
means for merging duplicate records in the plurality of Wa records. 

29. The network usage tracking system of claim 29 wmrein the means for 
20 completing the plurality of data records includes one or more netwonced computers 

rurming one or more programs. \ 

30. The network usage tracking system of claim 29 wherein tnfe means for 
storing the plurality of data records includes a relational database. \ 
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